PrefixSet: git-backed CIDR files via gitshallow, refreshed every 47 min.
DomainSet: CSV of static IPs/prefixes + hostnames resolved every 5 min;
retains stale IPs on resolve failure. Both use atomic-swapped ipcohort.Cohort
for lock-free reads.
replace directives in go.mod point to local siblings; remove after tagging.
